JAL Group's Basic Policies on Information Security and the Protection of
Personal Information
In light of the importance of information security and the protection of personal information in an advanced
information society, the JAL Group manages and protects information that the company possesses under thefollowing Group policies.

1. Compliance with Regulations
JAL complies with laws, regulations and guidelines stipulated by administrative bodies.

2. Establishment of management system
JAL has established an internal management system and clearly specifies division of responsibilities.

3. Compliance with internal policies, regulations and guidelines
JAL has established and complies with internal policies, regulations and guidelines.

4. Implementation of safety measures
JAL carries out safety measures and takes steps to prevent inappropriate access to information or the loss,
destruction, falsification and leak of information.

5. Implementation of education and awareness programs
JAL promotes education and awareness programs for employees and ensures that information isappropriately managed, while striving to improve knowledge and awareness of information management.

6. Affiliation with external vendors
When entrusting operations related to information management to other companies, JAL selects companies
with strong experience and abilities. The contract mandates confidentiality and guarantees that the
information will be properly managed.

7. Efforts to improve operations
JAL regularly checks to ensure that information is managed appropriately and works to improve operations on
a continual basis.

8. Response in event of accident
In the unlikely event of an accident, JAL endeavors to minimize the damage, quickly releases necessary
information and takes all necessary steps to prevent a reoccurrence.

9. Designation of contact
JAL will set up a contact point to which customers may direct their inquiries, complaints, and requests. JAL
will respond quickly and with integrity.

10. Release of policies
JAL will disclose its policies on information security and the protection of personal information, including thispolicy, by posting them on its website.

Handling of Personal Information by JAL Business Aviation Co., Ltd.
JAL Business Aviation Co., Ltd. shall handle and protect the customers' personal information in accordancewith the "Act on the Protection of Personal Information" of Japan and "JAL Group's Basic Policies on
Information Security and the Protection of Personal Information."

1. Obtaining Personal Information and Purpose of Use
JAL Business Aviation Co., Ltd. shall acquire the customers' personal information through appropriate and fairmeans and use it for the purposes below.
(1) To provide products and services(2) To provide other products and services(3) To provide information and communications; to conduct questionnaires relating to products, services,various events, campaigns, and such(4) To conduct sales analysis, investigations and research; to develop new services and products(5) To conduct operations relating to 1-4 above; to respond to inquiries, etc.

2. Management and Protection of Personal Information
JAL Business Aviation Co., Ltd. shall appropriately manage and protect the customers' personal information,in accordance with "JAL Group's Basic Policies on Information Security and the Protection of Personal
Information."

3. Provision of Personal Data to a Third Party
JAL Business Aviation Co., Ltd. shall not disclose or provide the customers' personal data to a third party,
except in cases described below. The provision of personal information to service providers and the joint use
of personal information shall be implemented in accordance with Articles 4. and 5. below(1) Cases in which the customer personally gives his/her consent

(2) Cases in which the provision of personal data is based on laws
(3) Cases in which the provision of personal data is necessary for the protection of the life, body, or
property of an individual and in which it is difficult to obtain the consent of the person(4) Cases in which the provision of personal data is specially necessary for improving public hygiene orpromoting the sound growth of children and in which it is difficult to obtain the consent of the person(5) Cases in which the provision of personal data is necessary for cooperating with a state institution, a
local public body, or an individual or entity entrusted by one in executing the operations prescribed bylaws and in which obtaining the consent of the person might impede the execution of the operations
concerned

4. Provision of Personal Information to Service Providers and Relevant Management
JAL Business Aviation Co., Ltd. may entrust the handling of personal information, within the scope required toachieve the purpose of use, to a third party other than the company itself. In this case, the JAL Group Airlines
shall conduct appropriate management and supervision in accordance with item 6 of "JAL Group's Basic
Policies on Information Security and the Protection of Personal Information."

5. Joint Use of Personal Information
JAL Business Aviation Co., Ltd. shall jointly use the customers' personal information as follows.
Purpose of joint use
To provide services; to provide services closely related to air travel such as tours, hotels and baggage
home delivery; to accumulate mileage and manage mileage awards; to provide information, e.g. sales
promotion materials including those of partner companies, questionnaires, product development, ;and to conduct other operations relating to those
Data to be used jointly
Membership number, customer's name, birthday, gender, address, TEL/FAX numbers, e-mailaddress, information on employment (company name, department, job title, address, TEL/FAX
numbers), mailing address of items sent to customers, e.g. itinerary, type of member's card,
member's service qualifications, membership region, accumulated mileage, reservations/boarding
information, need for arrangement of wheelchair, etc.
Range of users
JAL Group Companies

Administrator of personal information
JAL Business Aviation Co., Ltd.

6. Request for Disclosure, etc. and Inquiries(1) "Notification of purpose of use," "Disclosure," "Correction, etc." "Stopping the use, etc."of retained personal data
We will respond to requests by a customer or his/her representative as follows in accordance with the "Act on
the Protection of Personal Information" of Japan.
Notification of purpose of use
We will notify the purpose of use of such retained personal data as may lead to the identification of the person
concerned. However, in the following cases, we may reject a request, in whole or in part, and give the reason
why.
[1] Cases in which notifying the person of the purpose of use or publicly announcing it might harm the life,
body, property, or other rights or interests of the person or a third party[2] Cases in which notifying the person of the purpose of use or publicly announcing it might harm therights or legitimate interests of the JAL Group Airlines[3] Cases in which it is necessary to cooperate with a state institution or a local public body in executing
the operations prescribed by laws and in which notifying the person of the Purpose of Use or publicly
announcing it might impede the execution of the operations concerned

Disclosure
We will disclose such retained personal data as may lead to the identification of the person concerned. (Whenthe retained personal data does not exist, we will respond accordingly.) However, in the following cases, we
may reject a request, in whole or in part, and give the reason why.
[1] Cases in which disclosure might harm the life, body, property, or other rights or interests of the person
or a third party[2] Cases in which disclosure might seriously impede the proper execution of the business of the entity
concerned handling personal information[3] Cases in which disclosure violates other laws
Correction, etc.
When requested by a person to correct, add, or delete such retained personal data as may lead to theidentification of the person concerned on the ground that the retained personal data is contrary to the fact
(hereinafter "Correction, etc."), we will, except in cases in which special procedures are prescribed by anyother laws for such correction, addition, or deletion, make a necessary investigation. As a result, when we
have corrected, added, or deleted all or part of the retained personal data as requested, we will notify theeffect without delay. When we have decided not to make such correction, addition, or deletion, we will notify
and give the reason without delay.

Stopping the use, etc.
When requested to stop using, erase or stop providing to a third party such retained personal data as maylead to the identification of the person concerned (hereinafter "Stopping the use, etc."), and where it is foundthat the request has a reason, we will stop using, erase or stop providing to a third party the retained personal
data concerned without delay to the extent necessary for redressing the violation. However, if it costs a great
deal or otherwise difficult to stop using or to erase the retained personal data concerned, we may takenecessary alternative measures to protect the rights and interests of the person.
When we have stopped using, erased or stopped providing to a third party all or part of the retained personal
data as requested, we will notify without delay. When we have decided not to stop using, not to erase or not tostop providing a third party the retained personal data, we will notify and give the reason without delay.

(Procedures for Request)
Send a request in writing to the following address for the issues in relation to the matters listed in (*1)
together with the necessary documents described in (*2) and the fee described in (*3) if applicable.

Personal Data Controller
JAL Business Aviation Co., Ltd.
1-11-2 Haneda-Airport, Ota-ku
Tokyo 144-0041, JAPAN*1: Request matters•

Notification of Purpose of Use of Retained Personal Data in JAL Business Aviations' Possession•

Disclosure of Retained Personal Data in JAL Business Aviations' Possession•

Correction, etc. of Retained Personal Data in JAL Business Aviations' Possession•

Stopping the Use, etc. of

Retained Personal Data JAL Business Aviations' Possession*2: Required Documents
Please attach the documents below to verify the identity of the individual. When a request is sent by
a representative, please attach documents to verify the identity of the representative together with apower of attorney.
<Documents to identify the individual> (In case the request is sent by a representative, pleaseattach documents of the representative)
A copy of either one of the following; driver's license, passport, health insurance certificate, basic
resident registration card with photo, pension book, disability book, foreign resident registration
certificate, seal registration certificate (A certified copy of the seal registration issued by themunicipality.)<Documents to confirm address>
In case the address is not written by a public entity on the documents above, please attach acertified copy of the residence certificate or the original copy of the foreign resident registration(issued within 3 months prior to the request).
<Documents to confirm power of attorney>(In case of legal representative)
Documents to verify legal representative, e.g. family register, guardian registration certificate
In case a request is sent by a voluntary representative, we will check whether he/she has beencommissioned by the individual, we may disclose directly to the individual, or such.
*3: Fee
In case of requesting "Notification of purpose of use" or "Disclosure," please enclose stamps worth
500 yen as a fee.

(2) Contact for Inquiries
If you have any inquiries regarding "Handling of Personal Information by JAL Business Aviation Co., Ltd.. ",please send your letter to the following address.

Personal Data Controller
JAL Business Aviation Co., Ltd.
1-11-21 Haneda-Airport Ota-ku
Tokyo 140-0041, JAPAN(3) JAL Group Airlines: Processing of Personal Data in General Data Protection Regulation(GDPR)JAL Group Airlines: Processing of Personal Data in GDPRJAL Business Aviation Co., Ltd. process and protect customers' personal data as follows,
pursuant to the General Data Protection Regulation (hereinafter referred to as "GDPR") and the
JAL Group's Basic Policies for Information Security and Personal Data Protection.

1. Protection and Management of Personal Data
JAL Business Aviation Co., Ltd. properly manage and protect customers' personal data pursuant
to the JAL Group's Basic Policies for Information Security and Personal Data Protection.

2. Personal Data Controller and Data Protection Officer
1. Personal Data Controller
JAL Business Aviation Co., Ltd.
Address: 1-11-21 Haneda-Airport Ota-ku Tokyo 140-0041
2. Data Protection Officer
Address: 1-11-21 Haneda-Airport Ota-ku Tokyo 140-0041
E-mail: jalba@jal.com

3. Purpose and Legal Basis for Processing Personal Data
JAL Business Aviation Co., Ltd. properly process customers' personal data within the scope of thefollowing purposes:
Purpose of Processing
1

To provide air transportation services (Reservations, sales,
check-in, airport

To provide products and services

2 To provide other products and services

Legal BasisContract performanceContract performance

To provide information and communications; to conduct
3 questionnaires relating to products, services, various events,

Legitimate interests

campaigns, and such
4

5

To conduct sales analysis, investigations and research; todevelop new services and products
To conduct operations relating to 1-5 above; to respond toinquiries, etc.

Legitimate interests
Contract performance
Legal obligations
Legitimate interests

4. Personal Data Categories
JAL Business Aviation Co., Ltd. process customers' personal data necessary for the purposes
stated in "3. Purpose and Legal Basis for Processing Personal Data". Such personal data
includes:•Basic Data
Name, address, contact details (TEL/FAX numbers, e-mail address), gender, date of birth,country/region of residence, passport number, credit card number, information on
employment (company name, department, job title, address, TEL/FAX numbers), etc.

•

Data for Making Reservations and Itineraries
Reservation /boarding information (flight name, etc.), itinerary information, copy of e-ticket,
EMD, (online) check-in, accompanying passengers, incidental services (upgrades,
additional baggage, etc.), mailing address of items sent to customers, e.g. ticket, itinerary,etc.

•

JMB Membership Data
Membership number, member's service qualifications, membership region, accumulated
mileage, data related mileage awards, etc.

•

Communications Data
Records of communications with the JAL Group Airlines (recordings of phone calls to thecall center, records of responses to questions submitted via e-mail or web inquiry forms,
etc. Where necessary, records of questions or complaints, etc. received at airport
counters or when boarding, may be kept)•

Data Collected from Websites and Apps, etc.
Website access logs (IP address, Cookies, etc.) and data collected by apps, etc.

Where a customer reserves the JAL Business Aviation Co., Ltd.'s services via a third party suchas travel agents or other airline companies, some of the above-stated personal data may becollected from such third party. This policy also applies to personal data collected in such way.

Collection and Use of Sensitive Personal Data
JAL Business Aviation Co., Ltd. may collect and use sensitive personal data on customers whenproviding air transportation services. The collection and use of such sensitive personal data islimited to cases in which customers request Priority Guest Support when using air transportation
services, and such data is not used for any other purpose.

Examples of Processing Sensitive Personal Data•

Where requesting escort from check-in counter to departure gates for passengers that use
a wheelchair or are visually impaired•

Where requesting rental medical oxygen bottles or permission to carry-on a medical
oxygen bottle•

When requesting permission to carry-on syringes or other medical equipment for a chronic
disease•When a pregnant passenger requests to board a flight within 28 days expected delivery
date

Where a customer requests a special in-flight meal, etc., data may be processed that is notsensitive personal data but may indicate a customer's religious beliefs or state of health.
Customers have the right to withdraw consent for the processing of sensitive personal data.
Customers wishing to withdraw consent should contact where he or she applied for the service. It
may not be possible to provide all or some services if consent is withdrawn.

5. Refusal to Provide Personal Data
The provision of personal data on customers is necessary for customers to be provided withservices by JAL Business Aviation Co., Ltd. JAL Business Aviation Co., Ltd. may not be able toprovide a service in whole or in part if personal data is not provided.

6. Legitimate Interests of JAL Business Aviation Co., Ltd.
JAL Business Aviation Co., Ltd. have a legitimate business interest in the use of personal data
they collect to provide effective services and to perform the operations.

7. Disclosure and Provision of Personal Data to other Companies
1. JAL Business Aviation Co., Ltd. disclose and provide customers' personal data to JAL
Group companies to achieve the purposes stated in "3. Purpose and Legal Basis for
Processing Personal Data".
Refer to the following website for details on group companies.
JAL Group Information
2. Customers' data may be disclosed or provided to partner airlines or companies entrustedwith ground handling and check-in operations to provide air transportation services suchas when using code share flights or connecting flights, and to achieve purposes such as
mileage accumulation.
3. Where customers have made reservations via a travel agent, customer data is disclosed
and provided to such travel agent in relation to the reservation.
4. JAL Business Aviation Co., Ltd. may conduct surveys relating to their services, etc. using
an external web service. When a customer answers a survey, some personal data on
customers is disclosed or provided to the operator that provides the web service. Whenrequesting a response to a survey JAL Business Aviation Co., Ltd. indicate the name ofthe operator and matters concerning the processing of personal data by the operator.
5. Where required by law, customer data relating to reservations and itineraries (including
passport, visa, and API data) may be submitted to the customs authorities or immigration
bureaus in the customers' countries to be flown from, into or over, or in countries of transit
and transfer.
6. Customers' personal data may be disclosed or provided to authorities or recipientsprescribed in laws and regulations where necessary to comply with EU law or the laws andregulations of members of the EU/EEA.

8. Transfer of Personal Data to Non-EU Third Countries
JAL Business Aviation Co., Ltd. may transfer customers' personal data from within the EU/EEA to
non EU/EEA countries and regions where there are airports serviced by JAL Group Airlines inorder to achieve the purposes stated in "3. Purpose and Legal Basis for Processing Personal
Data".
In such case, except when the European Commission determines that the country or region has
secured data protection at an adequate level, in principle, customers' personal data is transferred
after executing standard data protection clauses as an appropriate protection measure inaccordance with the provisions of the GDPR and the laws and regulations of EU/EEA member
states.
Contact the inquiries section stated in "12. Inquiries" with questions, etc. regarding the above
stated protection measures.

9. Management of Personal Data
JAL Business Aviation Co., Ltd. retain customers' personal data for the period necessary toachieve the purposes stated in "3. Purpose and Legal Basis for Processing Personal Data".

Records concerning boarding by customers, such as reservations records and ticket information,
are normally retained after boarding for a maximum of three years.
Data collected during communication with customers (customer service records, records ofe-mails received, etc.) is retained for the period necessary to provide even better services tocustomers.
Access logs, etc. recorded when the JAL Business Aviation website is accessed are retained forthe period necessary for analysis by JAL Business Aviation.

10. How to Request Disclosure, etc. and Make Inquiries
When a data subject or his or her representative makes a request concerning personal dataretained by JAL Business Aviation Co., Ltd.., the Company shall respond as follows inaccordance with GDPR:•

Disclosure
The Company discloses retained personal data that identifies the data subject. (TheCompany will inform the data subject to such effect if there is no retained personal datathat identifies the data subject.) However, where corresponding to any of the following, theCompany may notify the data subject of the reason and refuse to disclose data in whole orin part.
1. Where the data subject's or a third party's life, health, property, or other rights orinterests are likely to be harmed
2. Where the proper implementation of JAL Business Aviation Co., Ltd..' operations
are likely to be hindered
3. Where disclosure will violate laws and regulations•

Rectification
Where requested to rectify or make additions (hereinafter referred to as "Rectification,etc.") to retained personal data due to the retained personal data that identifies the data
subject being incorrect, unless special procedures are prescribed in the provisions of laws
and regulations regarding the Rectification, etc. of such details, the Company shallconduct necessary investigations without delay within the scope necessary to achieve
purpose of processing. The Company shall notify of details without delay when all or a partof the retained personal data is Rectified, etc. as a result. The data subject shall benotified of such effect, outlining the grounds, if a decision is made not to carry out
Rectification, etc.

•

ErasureWhere requested to erase retained personal data that identifies the data subject, theCompany shall conduct necessary checks without delay such as where personal data isnecessary in light of the purpose of processing. The Company shall notify of details
without delay when all or a part of the retained personal data is erased as a result. The
data subject shall be notified of such effect, outlining the grounds, if a decision is made notto carry out erasure.

•

Suspension of Use, etc.
Where requested to suspend use, erase, or suspend provision to a third party (hereinafterreferred to as "Suspension of Use, etc.") of retained personal data, and when there is
discovered to be grounds for such a request, the Company shall Suspend Use, etc. ofsuch retained personal data without delay, to the extent necessary; provided, however,that where Suspension of Use, etc. of such retained personal data requires a considerable
expense, or where Suspension of Use, etc. is otherwise difficult, the Company may
substitute Suspension of Use, etc. with alternative measures necessary to protect therights and interest of the data subject. The Company shall notify the data subject of such
effect without delay when it has Suspended Use, etc. of all or a part of the retained
personal data. The data subject shall be notified of such effect, outlining the grounds, if adecision is made not to carry out Suspension of Use, etc.

Procedure for Making Requests
Send a request in writing to the following address for the issues in relation to the matters listed in (*1).
In case the request is to disclosure of Personal Data, please send a request together with the necessary
documents described in (*2)

Personal Data Controller
JAL Business Aviation Co., Ltd.
Address: 1-11-21 Haneda-Airport Ota-ku Tokyo 140-0041

*1 Request matters•

Notification of Purpose of Use of Retained Personal Data in JAL Business Aviations' Possession•

Disclosure of Retained Personal Data in JAL Business Aviations' Possession•

Correction, etc. of Retained Personal Data in JAL Business Aviations' Possession•

Erasure of Retained Personal Data in JAL Business Aviations' Possession•

Stopping the Use, etc. of Retained Personal Data JAL Business Aviations' Possession•

Statement for Objection of Retained Personal Data JAL Business Aviations' Possession*2 Necessary documentation
Attach the following documents to confirm the identity of the data subject. Where requests are
made by a representative, attach documents to confirm the identity of the representative
together with documents to confirm the right to represent.
[Data Subject Identify Confirmation Documents] (Where requests are made by arepresentative, attach documents concerning the representative)
A copy of a driver's license, passport, health insurance card, or any other document
issued by a public agency that can used to confirm the identity customer[Address Confirmation Documents]
Where the above document (from a government or public office) does not include anaddress, in order to confirm the addressee, attach a document issued by a public agency
that indicates a current address (issued within three months of making the request).
[Right of Representation Confirmation Documents]
Parental Authority:
Document that confirms the representative has parental authority
Guardian of Adult:
Document that confirms the representative is a guardian of adult
Statutory Agent:
Document that proves the representative is a statutory agent
Voluntary Representative:
Letter of proxy (signed by data subject)
In the case of requests from voluntary representatives, the Company may confirm
delegation with the data subject or directly disclose, etc. personal data to the data subject.

12. Inquiries
If you have any inquiries regarding " JAL Business Aviations: Processing of Personal Data in
GDPR", please send your letter to the following address:
Personal Data Controller
JAL Business Aviation Co., Ltd.
Address: 1-11-21 Haneda-Airport Ota-ku
Tokyo 140-0041